SSL Certificates

If you are running an ecommerce site, accepting credit cards, or passing information that needs to be encrypted, you’ll need an SSL certificate for your WordPress site. Having an SSL certificate will allow you to enable HTTPS, which ensures that no information is passed in plain text. In fact, we recommend all sites utilize HTTPS, as it has a lot of additional benefits beyond security.

At Kinsta, you have two options for your site’s SSL: a free Cloudflare SSL or a custom SSL that you purchase yourself.

Option 1 — Free Cloudflare SSL

All verified domains at Kinsta are automatically protected by our Cloudflare integration, which includes free SSL certificates. After you’ve added your domain, your site is automatically secured by this certificate. For our Managed WordPress Hosting plans, the free SSL certificates also offer wildcard support.

Unless you have a specific reason to add a custom SSL, you can take advantage of our easy one-click solution, and you won’t have to worry about manually configuring and updating the SSL certificate on Kinsta.

Renew Free Cloudflare SSL Certificate

Wildcard SSL certificate renewals require a new TXT record to be added for each domain. The TXT record is unique for each domain and changes with each renewal.

If you’re using our free Cloudflare SSL certificate and using Kinsta’s DNS for your site, the renewal process is automatically handled by Cloudflare. If you’re not using Kinsta’s DNS, you’ll need to add a TXT record to your domain for the renewal.

1. If you have not yet added a CNAME record for the SSL renewal, you’ll receive an email message and a notification in MyKinsta 30 days before your SSL expires to let you know your SSL certificate is expiring soon. Click on the Get TXT record button in the message to go to the site’s Domains list, where you’ll see a Renew SSL button next to the domain.

   

2. Click that button to show the CNAME record you’ll need to add to your domain’s DNS.

   

3. Log in to your DNS provider’s management panel and add the new CNAME record to your domain. Your DNS provider is where your domain’s name servers are pointed. This may be your domain’s registrar but could be another DNS provider. If needed, you can refer to your provider’s documentation for more information on adding DNS records.
4. Depending on your DNS provider, the CNAME records may take up to 24 hours to propagate. After a successful domain verification, you’ll receive an email message and notification in MyKinsta, letting you know your SSL certificate has been renewed.

Renewing an Expired Certificate

If you’re unable to add the CNAME record to your domain before your SSL certificate expires, you’ll receive another email message and notification letting you know your certificate has expired and you need to renew it. The steps to renew an expired certificate are the same as adding a CNAME record for renewal above.

Troubleshooting the Fix Domain Error

During the SSL renewal process, if a Fix domain error button appears next to the domain, this means a CAA record conflict is occurring.

A CAA record is an optional DNS record that lets you specify which certificate authorities (CAs) are allowed to issue SSL certificates for your domain. If a domain has no CAA records, any CA can generate an SSL certificate for it if requested. If a domain has a CAA record, only the CA(s) specified in the CA record can generate an SSL certificate for the domain.

To resolve this error, click the Fix domain error button and update the CAA record as indicated in the modal/pop-up. Alternatively, if you do not need a CAA record on your domain, you can remove the CAA record.

Option 2 — Custom SSL Certificate

For users who prefer to go the custom SSL route, Kinsta also supports custom SSL certificates.

Step 1 — Obtain Custom SSL Certificate

There are three ways to obtain your custom SSL certificate:

• If you have a custom SSL certificate and have access to the certificate and key, you can transfer the SSL certificate from your previous server.
• If you have a custom SSL certificate but do not have access to the certificate and key, you can have the SSL certificate regenerated by your SSL provider.
• If you do not yet have a custom SSL certificate but want to install one on your site, you can purchase a new SSL one from any vendor you like, such as Comodo, DigiCert, GeoTrust, Thawte, or Trustwave.

Transfer an SSL Certificate From Another Server

To transfer an SSL certificate you installed on another server, you’ll need to get a copy of your SSL certificate and the certificate’s private key. This private key is created when you generate your CSR and is installed on the server.

If your site is coming from a host that uses cPanel, these can typically be extracted from cPanel directly or from the file manager. If your previous host doesn’t use cPanel, their support team may be able to assist you with getting a copy of your SSL certificate.

Regenerate a Custom SSL Certificate

If you’ve misplaced or do not have access to your certificate’s private key, you’ll need to generate a new CSR and private key (as explained below for purchasing a new certificate). Then, contact your SSL provider to have the SSL certificate regenerated with the new CSR.

Upload only your CSR with your SSL provider to generate your SSL certificate (.cert file). Once you receive your SSL certificate from your provider (usually a .crt or .cer file and a .ca-bundle file), you can install it in MyKinsta.

Purchase a New SSL Certificate

When you purchase your new SSL certificate, you’ll be asked to provide the server type. Our web server type is Nginx. If that option is not available, then “Apache” or “Other” will also work.

The SSL provider will need a CSR (Certificate Signing Request) to create/sign the certificate file. For generating a CSR and RSA key (together known as a key pair), please complete this form: Online CSR and Key Generator.

We recommend filling out every field, but at a minimum, you should fill in the following, as seen in the example below:

• Common name (domain name)
• Email Address
• Organization
• City / Locality
• State / County / Region
• Country

Note: For the common name field, if you’re generating a wildcard certificate, you’ll need to input your domain name like *.domain.com.

The form will generate the Private Key file and the CSR. Save both of those, as the certificate will be unusable without them.

Upload only your CSR with your SSL provider to generate your SSL certificate (.cert file). Once you receive your SSL certificate from your provider (usually a .crt or .cer file and a .ca-bundle file), you can install it in MyKinsta.

Step 2 — Install Custom SSL Certificate

Navigate to WordPress Sites > sitename > Domains. Click the kebab (three-dot) menu for the domain you want to add a custom SSL certificate to and select Add custom SSL certificate from the dropdown menu.

Confirm Domains Covered by the SSL

Next, you’ll see a confirmation modal showing the domains that the custom SSL will cover. Click the Next button to proceed to the next step.

Add SSL and Private Key

You will then be able to add your private key (.key) and certificate (.cert, .cer., or .crt file).

Most SSL providers will email you a .crt or .cer file and a .ca-bundle file. You can use a text editor like Notepad++ or TextMate to open the certificate and bundle files, and copy the content of each file.

Paste the contents of your certificate file in the .cert file contents field first and then the contents of the .ca-bundle file below that in the same field.

Click the Add certificate button to finalize the configuration process.

Check Your SSL Certificate

After you have installed your SSL certificate, we recommend running an SSL check to verify that everything is set up correctly. An invalid SSL certificate can cause your visitors to be faced with the “your connection is not private” error.

Renew Custom SSL Certificate

An SSL certificate doesn’t last forever, so it will need to be renewed before it expires. If you’re not sure if your site is using our free Cloudflare SSL certificate or a custom SSL certificate, there are a couple of ways you can check to see who the issuer is. If the issuer’s name is anything other than Cloudflare, your site is using a custom SSL certificate.

To check the issuer name, view the certificate in your browser and look for the Organization in the Issuer Name section, or use a tool like SSLShopper’s SSL Checker and view the Issuer information.

If you have a custom SSL certificate, you’ll need to renew it with the SSL provider from which it was purchased. Once your SSL is renewed, and you receive the updated files from your SSL provider, you’ll need to install the updated SSL certificate in MyKinsta.

Redirect HTTP to HTTPS in MyKinsta

We’ve made redirecting all of your HTTP traffic to HTTPS as easy as possible in MyKinsta.

1. Log in to MyKinsta, select your site, and click on Tools.
2. Under Force HTTPS, click the Enable button.

   

3. In the Enable Force HTTPS modal/pop-up that appears, you can choose to force HTTPS on all live domains or force HTTPS and redirect all traffic to your primary domain. Click Force HTTPS to confirm the change.

   

4. This step is optional since forcing HTTPS will handle redirecting to HTTPS, but if you want to make sure all URLs in your database are using HTTPS, you can use the Search and replace tool in MyKinsta to update those.
5. Lastly, another optional step is to check your URL’s HTTP status and redirect chain with our free HTTP status and redirect checker.